Repository navigation
Releases
Releases · maxmind/libmaxminddb
1.14.1
- Fixed a
-Wsign-comparewarning inMMDB_open()that broke builds with
-Werroron platforms wheressize_tis 32 bits, such as i686. Pull request
by Robert Scheck. GitHub #487.
1.14.0
- Bounded the resources that
MMDB_get_entry_data_list()spends decoding a
single entry. A crafted database could nest data-section pointers to shared
targets so that decoding one entry cost exponential time and memory, or point
many times at one large value so that a caller copying the result materialized
far more data than the file holds. The decoder now follows the Reader Resource
Limits section of the MaxMind DB specification. Each call is limited to 65,536
values and 2 MiB of string and bytes payload, in addition to the existing
recursive-decoder depth limit of 512. See theMMDB_get_entry_data_list()
documentation for details.- Exceeding a limit returns the new
MMDB_DECODER_LIMIT_ERRORstatus. A
full-list failure leaves the output set toNULL. MMDB_get_value(),MMDB_vget_value(), andMMDB_aget_value()now return
MMDB_DECODER_LIMIT_ERRORinstead ofMMDB_INVALID_DATA_ERRORwhen they
skip a subtree past the depth limit.MMDB_open()returnsMMDB_INVALID_METADATA_ERRORwhen metadata processing
exceeds a decoder limit.- The limits can be raised when building the library with
-DMAXIMUM_DATA_STRUCTURE_DEPTH,-DMAXIMUM_DATA_STRUCTURE_VALUES, and
-DMAXIMUM_DATA_STRUCTURE_BYTES.
- Exceeding a limit returns the new
- Fixed an out-of-bounds read in
MMDB_lookup_sockaddr()when callers passed a
sockaddrwith an unsupported address family. The function now rejects any
family other thanAF_INETandAF_INET6with
MMDB_INVALID_NETWORK_ADDRESS_ERROR. - Fixed metadata parsing for files that end immediately after the
\xAB\xCD\xEFMaxMind.commarker. Such files are now rejected as invalid
metadata instead of allowing a zero-length metadata section to reach the
decoder. - Fixed search-tree validation for records that point into the 16-byte separator
before the data section. These records are now rejected as corrupt instead of
being exposed as apparent data entries with underflowed offsets. MMDB_read_node()now returnsMMDB_CORRUPT_SEARCH_TREE_ERRORinstead of
MMDB_SUCCESSwithMMDB_RECORD_TYPE_INVALIDrecord types when a node's
child record is invalid.
1.13.3
- Fixed validation of empty maps and arrays at the end of the metadata section.
MMDB_openwould incorrectly reject databases where a 0-element map or array
was the last field in metadata. Reported in vimt/MaxMind-DB-Writer-python#16.
1.13.2
- Fixed a compilation failure on macOS 26 (Tahoe) where
sys/endian.hdefines
bswap32andbswap64as macros, conflicting with our function declarations.
Reported by Anton Melnikov. GitHub #419.
1.13.1
1.13.0
MMDB_get_entry_data_list()now validates that the claimed array/map size is
plausible given the remaining bytes in the data section. A crafted database
could previously claim millions of array elements while only having a few
bytes of data, causing disproportionate memory allocation (memory
amplification DoS).- On Windows,
GetFileSize()was replaced withGetFileSizeEx()to correctly
handle files larger than 4GB. The previous code passedNULLfor the high
DWORD, discarding the upper 32 bits of the file size. - Fixed integer overflow in
MMDB_read_node()andfind_ipv4_start_node()
pointer arithmetic. Thenode_number * record_lengthmultiplication was
performed inuint32_t, which could overflow for very large databases. Now
cast touint64_tbefore multiplying, matching the pattern already used in
find_address_in_search_tree(). - Fixed printf format specifier mismatches in
mmdblookup's metadata dump.%i
was used for unsigned types and%lluforuint64_t, which is technically
undefined behavior. Now uses the portablePRIu32,PRIu16, andPRIu64
macros from<inttypes.h>. - Fixed an integer overflow in the search tree bounds check in
find_address_in_search_tree(). The addition ofnode_countand
data_section_sizewas performed inuint32_tarithmetic, which could wrap
on very large databases, causing valid lookups to be incorrectly rejected as
corrupt. - Fixed a NULL pointer dereference in
mmdblookupwhen displaying metadata for
a database with an out-of-rangebuild_epoch. Thegmtime()return value is
now checked before passing tostrftime(). MMDB_close()now NULLs thefile_content,data_section, and
metadata_sectionpointers and zeroesfile_size,data_section_size, and
metadata_section_sizeafter unmapping. Previously, callingMMDB_close()
twice on the same struct (or calling it after a failedMMDB_open()that
succeeded at mapping) would double-munmap the file content, which is undefined
behavior.- Fixed a stack buffer overflow in
print_indentation()when
MMDB_dump_entry_data_list()was called with a negativeindentvalue. The
negative integer was cast tosize_t, producing a massive value passed to
memset(). Negative indent values are now clamped to 0. MMDB_lookup_string()now sets*mmdb_errortoMMDB_SUCCESSwhen
getaddrinfofails (non-zero*gai_error). Previously,*mmdb_errorwas
left uninitialized in this case, which could cause callers to read an
indeterminate value.- Fixed an off-by-one in
mmdblookupon Windows whereallocaallocated one
byte too few for the program name buffer, causing_splitpathto write one
byte past the end when appending the null terminator. - Added a recursion depth limit to
skip_map_or_array(), matching the existing
MAXIMUM_DATA_STRUCTURE_DEPTH(512) limit already used by
get_entry_data_list(). A crafted MMDB file with deeply nested maps or arrays
could previously cause a stack overflow via unbounded recursion in the
MMDB_aget_value/MMDB_get_valuecode path. - Fixed an off-by-one error in
MMDB_read_node()that allowed reading one node
past the end of the search tree when called withnode_number == node_count.
This caused the function to read from the data section separator and return an
invalid record with an underflowed data offset. The check now correctly
rejectsnode_number >= node_count. - The handling of float and double types was rewritten to fix compiler errors
and to eliminate the use of volatile. - Improved endian preprocessor check if
MMDB_LITTLE_ENDIANis not set.
1.12.2
MMDB_get_entry_data_list()now always sets the passedentry_data_list
parameter to eitherNULLor valid memory. This makes it safe for
callers to useMMDB_free_entry_data_list()on it even in case of error.
In 1.12.0MMDB_get_entry_data_list()was changed to not set this
parameter to valid memory in additional error cases. That change caused
segfaults for certain libraries that assumed it was safe to free memory
on error. Doing so was never safe, but worked in some cases. This change
makes such calls safe. Reported by Petr Pisar. GitHub
maxmind/MaxMind-DB-Reader-XS#39.
1.12.1
- Added missing
cmake_uninstall.cmake.into the source distribution. This
was missing from 1.12.0, causing CMake builds to fail. Reported by Marcel
Raad. GitHub #367.
1.12.0
- Fixed memory leaks in
MMDB_open(). These could happen with invalid
databases or in error situations such as failing to allocate memory. As
part of the fix,MMDB_get_entry_data_list()now frees memory it
allocates on additional errors. Previously it failed to clean up when
certain errors occurred. Pull request by pkillarjun. GitHub #356. - There is now a build target to fuzz the library. Pull request by
pkillarjun. GitHub #357. - Updated
cmake_minimum_requiredto a version range to quiet deprecation
warnings on new CMake versions. Reported by gmou3. GitHub #359. - The script for generating man pages no longer uses
autodie. This
eliminates the dependency onIPC::System::Simple. Reported by gmou3.
GitHub #359. - An uninstall target is now included for CMake. Pull request by gmou3.
GitHub #362.
1.11.0
- When building with CMake, the man pages will now be generated and
installed. Requested by Thomas Klausner. GitHub #351. - Removed unnecessary
$<INSTALL_INTERFACE:generated>directory from
target_include_directoriesin the CMake build configuration. This is
a private build directory. Pull request by Ankur Verma. GitHub #354.
